How reliable is your data center service provider? Perhaps not as reliable as you think.

The Uptime Institute says some data centers are playing fast and loose with its “tiering” system for rating data center reliability, making false claims or at best being economical with the truth about how resilient their facilities are.

The upshot, the Institute says, is that some companies may be running important applications in data centers that are more susceptible to failure than is advertised, and they may get a rude awakening the next time a hurricane strikes or a transformer blows out in the local power grid.

“At a time when more enterprises are moving at scale to an outsourcing option, the stakes couldn’t be higher,” said Julian Kudritzki, Uptime Institute’s chief operating officer, who along with a few data center operators is trying to raise awareness of the issue.

Microsoft

The Institute’s tiering system is only one way of indicating data center resiliency, but it has become well known in the industry. It gives four tiers of certification, with Tier III the most common type awarded. A Tier III data center has multiple delivery paths for power and cooling, and redundant critical components, so that downtime is minimized and maintenance can be performed without taking the computing services offline.

Customers can be misled in a variety of ways. Some data centers imply they’re Uptime certified when they’re not, while others advertise their Uptime “design” certification, which shows only that the plans for a facility met certain criteria. Vendors are expected to follow that up with a “constructed facility” certification to verify the data center was built to spec, but many never do.

Complicating matters is that Uptime’s “tier” language has become part of the industry vernacular. Some operators say they use it as a shorthand to convey a certain level of reliability, and that they’re not trying to intentionally mislead customers.

Not surprisingly, data centers that have made the investment to get certified don’t buy that argument.

“It’s a bit of sleight of hand,” said Chris Crosby, founder of Compass Datacenters.

Two of Compass’ data centers are Tier III constructed facilities, and Crosby wants the system better policed so that the credentials remain meaningful. In the long run, he argues, better policing is good for the rest of the industry, too. More and more customers are outsourcing their computer operations, and if enterprises start to think they can’t trust their service provider, the commercial data center industry as a whole will suffer, he says.

Users need to educate themselves about the various certifications and press commercial data centers to verify their credentials, Kudritzki said. “The counsel is ‘buyers beware.’”

Some data centers certainly appear to make questionable claims. Arsalon Technologies of Lenexa, Kansas, says on its website that its hosting facilities “comply with Uptime Institute data center standards.” A page headed “Data Center Certifications” refers several times to “tier III” standards.

In reality, Arsalon doesn’t have any certification from the Uptime Institute. The company didn’t return calls and emails seeking comment.

More common are data centers that advertise their tier “design” logo. It’s a real certificate, but it was introduced as a way to help data centers secure “anchor tenants” before a facility is built, Kudritzki said, not for marketing a data center once it’s operational. A lot can change in between: contractors cut corners, plans change and budgets get cut.

To be certified as a constructed facility, data centers go through extensive on-site testing by Uptime staff. But some data centers imply their design certificate is the only one customers need to care about. Recovery Point Systems of Gaithersburg, Maryland, for example, describes its design certificate as “the industry’s most coveted recognition.”

Others use the tier language as a general shorthand for reliability.

“We’re a tier 3 on the electrical side, Tier 4 on mechanical, Tier 4 on communications and security, and we’ll go through several audits to determine physical security and data connectivity,” Don Phares, a contractor for Nebraska Colocation Centers, told the Journal Star newspaper last month about a data center he was building.

“Then once you get through everything, we’re a 2 enhanced almost to a 3,” he told the paper.

That type of language is Kudritzki’s worst nightmare, but Phares says he wasn’t trying to mislead anyone. In a telephone interview, he said that even some of his equipment vendors market their products as meeting certain tier requirements.

Ken Moreano, president of Scott Data Center, said customers should be specific when they’re shopping for services. His company runs a Tier III constructed facility in Omaha, Nebraska, and he’s concerned at the number of RFPs (requests for proposals) he sees that don’t ask for any type of verification.

“Many RFPs provide the latitude for people to claim a tier level without an actual certification,” he said.

He doesn’t think all data centers that claim a tier level without certification are being “malicious,” but he says he’s seen facilities that fall far short of the level they claim to have achieved, “and I have to question their motives.”

Uptime Institute charges a fee for certification, and some data centers say they simply don’t want to pay it, but Moreano thinks those arguments are spurious. The fees are “very minor compared to the overall cost of these large-scale data centers,” he said.

In some ways, Uptime Institute has created problems for itself. The design certification arguably opened the door to misuse. And the Institute has licensed its rating system to the Telecommunications Industry Association, which incorporated the tier language into its own data center standards, known as TIA-942-A.

Uptime says the TIA has been misusing the tier language, and in June it wrote the association a letter asking it to stop using it.

Kudritzki said the Institute generally doesn’t file lawsuits against data centers; its goal is to help the industry rather than cause it problems. But it has asked some facilities to make clear that they are not Uptime certified, with some success.

In the meantime, he said, customers should ensure they know what level of service they’re paying for. The Institute keeps an up-to-date list of the data centers that are design certified and construction certified on its website.

To comment on this article and other PCWorld content, visit our Facebook page or our Twitter feed.